SECURITY:

• api: sanitize the SignedIdentities in allocations of events to clean the identity token. [GH-24966]
• build: Updated Go to 1.23.6 [GH-25041]
• event stream: fixes vulnerability CVE-2025-0937, where using a wildcard namespace to subscribe to the events API grants a user with "read" capabilites on any namespace, the ability to read events from all namespaces. [GH-25089]

IMPROVEMENTS:

• auth: adds VerboseLogging option to auth-method config for debugging SSO [GH-24892]
• event stream: adds ability to authenticate using workload identities [GH-24849]

BUG FIXES:

• agent: Fixed a bug where Nomad error log messages within syslog showed via the notice priority [GH-24820]
• agent: Fixed a bug where all syslog entries were marked as notice when using JSON logging format [GH-24865]
• client: Fixed a bug where temporary RPC errors cause the client to poll for changes more frequently thereafter [GH-25039]
• csi: Fixed a bug where volume context from the plugin would be erased on volume updates [GH-24922]
• networking: check network namespaces on Linux during client restarts and fail the allocation if an existing namespace is invalid [GH-24658]
• reporting (Enterprise): Updated the reporting metric to utilize node active heartbeat count. [GH-24919]
• state store: fix for setting correct status for a job version when reverting, and also fixes an issue where jobs were briefly marked dead during restarts [GH-24974]
• taskrunner: fix panic when a task with dynamic user is recovered [GH-24739]
• ui: Ensure pending service check blocks are filled [GH-24818]
• ui: Remove unrequired node read API call when attempting to stream task logs [GH-24973]
• vault: Fixed a bug where successful renewal was logged as an error [GH-25040]

1.9.6 (February 11, 2025)

BREAKING CHANGES:

• fingerprint: Consul and Vault fingerprints no longer reload periodically [GH-24526]

SECURITY:

• api: sanitize the SignedIdentities in allocations of events to clean the identity token. [GH-24966]
• build: Updated Go to 1.23.6 [GH-25041]
• event stream: fixes vulnerability CVE-2025-0937, where using a wildcard namespace to subscribe to the events API grants a user with "read" capabilites on any namespace, the ability to read events from all namespaces. [GH-25089]

IMPROVEMENTS:

• auth: adds VerboseLogging option to auth-method config for debugging SSO [GH-24892]
• cli: Added actions available to a job when running nomad job status command [GH-24959]
• event stream: adds ability to authenticate using workload identities [GH-24849]
• services: Nomad service checks now support the tls_skip_verify parameter [GH-24781]
• task schedule: The task being paused no longer impacts restart attempts [GH-25085]
• ui: Contextualizes the Start Job button on whether it is startable, revertable, or not [GH-24985]

BUG FIXES:

• agent: Fixed a bug where Nomad error log messages within syslog showed via the notice priority [GH-24820]
• agent: Fixed a bug where all syslog entries were marked as notice when using JSON logging format [GH-24865]
• client: Fixed a bug where temporary RPC errors cause the client to poll for changes more frequently thereafter [GH-25039]
• csi: Fixed a bug where volume context from the plugin would be erased on volume updates [GH-24922]
• docker: Fixed a bug that prevented image_pull_timeout from being applied [GH-24991]
• docker: Fixed a bug where "error reading image pull progress" caused the allocation to get stuck pending [GH-24981]
• reporting (Enterprise): Updated the reporting metric to utilize node active heartbeat count. [GH-24919]
• state store: fix for setting correct status for a job version when reverting, and also fixes an issue where jobs were briefly marked dead during restarts [GH-24974]
• taskrunner: fix panic when a task with dynamic user is recovered [GH-24739]
• ui: Ensure pending service check blocks are filled [GH-24818]
• ui: Remove unrequired node read API call when attempting to stream task logs [GH-24973]
• vault: Fixed a bug where successful renewal was logged as an error [GH-25040]

IMPROVEMENTS:

• api: Sanitise hcl variables before storage on JobSubmission [GH-24423]
• deps: Upgraded aws-sdk-go from v1 to v2 [GH-24720]

BUG FIXES:

• drivers: validate logmon plugin during reattach [GH-24798]

IMPROVEMENTS:

• deps: Upgraded aws-sdk-go from v1 to v2 [GH-24720]

BUG FIXES:

• drivers: validate logmon plugin during reattach [GH-24798]

1.9.5 (January 14, 2025)

IMPROVEMENTS:

• client: Add noswap mount option to secrets directory where supported on Linux [GH-24645]
• deps: Upgraded aws-sdk-go from v1 to v2 [GH-24720]
• keyring: Warn if deleting a key previously used to encrypt an existing variable [GH-24766]
• ui: Added possibility to supply HCL variable values on job submission [GH-24622]
• ui: add leadership status for servers in other regions [GH-24723]

BUG FIXES:

• docker: Fix a bug where images with port number and no tags weren't parsed correctly [GH-24547]
• driver/docker: Fix container CPU stats collection where previous CPU stats were missing and causing incorrect calculations [GH-24768]
• drivers: validate logmon plugin during reattach [GH-24798]
• networking: check network namespaces on Linux during client restarts and fail the allocation if an existing namespace is invalid [GH-24658]

SECURITY:

• api: sanitize the SignedIdentities in allocations to prevent privilege escalation through unredacted workload identity token impersonation associated with ACL policies. [GH-24683]
• security: Added more host environment variables to the default deny list for tasks [GH-24540]
• security: Explicitly set 'Content-Type' header to mitigate XSS vulnerability [GH-24489]
• security: add executeTemplate to default template function_denylist [GH-24541]

BUG FIXES:

• agent: Fixed a bug where retry_join gave up after a single failure, rather than retrying until max attempts had been reached [GH-24561]
• cli: Ensure the operator autopilot health command only outputs JSON when the json flag is supplied [GH-24655]
• consul: Fixed a bug where failures when syncing Consul checks could panic the Nomad agent [GH-24513]
• consul: Fixed a bug where non-root Nomad agents could not recreate a task's Consul token on task restart [GH-24410]
• csi: Fixed a bug where drivers that emit multiple topology segments would cause placements to fail [GH-24522]
• csi: Removed redundant namespace output from volume status command [GH-24432]
• discovery: Fixed a bug where IPv6 addresses would not be accepted from cloud autojoin [GH-24649]
• drivers: fix executor leak when drivers error starting tasks [GH-24495]
• executor: validate executor on reattach to avoid possibility of killing non-Nomad processes [GH-24538]
• fix: handles consul template re-renders on client restart [GH-24399]
• networking: use a tmpfs location for the state of CNI IPAM plugin used by bridge mode, to fix a bug where allocations would fail to restore after host reboot [GH-24650]
• scheduler: take all assigned cpu cores into account instead of only those part of the largest lifecycle [GH-24304]
• vault: Fixed a bug where expired secret leases were treated as non-fatal and retried [GH-24409]
• windows: Restore process accounting logic from Nomad 1.6.x [GH-24494]

SECURITY:

• api: sanitize the SignedIdentities in allocations to prevent privilege escalation through unredacted workload identity token impersonation associated with ACL policies. [GH-24683]
• security: Added more host environment variables to the default deny list for tasks [GH-24540]
• security: Explicitly set 'Content-Type' header to mitigate XSS vulnerability [GH-24489]
• security: add executeTemplate to default template function_denylist [GH-24541]

BUG FIXES:

• agent: Fixed a bug where retry_join gave up after a single failure, rather than retrying until max attempts had been reached [GH-24561]
• api: Fixed a bug where alloc exec/logs/fs APIs would return errors for non-global regions [GH-24644]
• cli: Ensure the operator autopilot health command only outputs JSON when the json flag is supplied [GH-24655]
• consul: Fixed a bug where failures when syncing Consul checks could panic the Nomad agent [GH-24513]
• consul: Fixed a bug where non-root Nomad agents could not recreate a task's Consul token on task restart [GH-24410]
• csi: Fixed a bug where drivers that emit multiple topology segments would cause placements to fail [GH-24522]
• csi: Removed redundant namespace output from volume status command [GH-24432]
• discovery: Fixed a bug where IPv6 addresses would not be accepted from cloud autojoin [GH-24649]
• drivers: fix executor leak when drivers error starting tasks [GH-24495]
• executor: validate executor on reattach to avoid possibility of killing non-Nomad processes [GH-24538]
• fix: handles consul template re-renders on client restart [GH-24399]
• networking: use a tmpfs location for the state of CNI IPAM plugin used by bridge mode, to fix a bug where allocations would fail to restore after host reboot [GH-24650]
• scheduler: take all assigned cpu cores into account instead of only those part of the largest lifecycle [GH-24304]
• vault: Fixed a bug where expired secret leases were treated as non-fatal and retried [GH-24409]

1.9.4 (December 18, 2024)

SECURITY:

• api: sanitize the SignedIdentities in allocations to prevent privilege escalation through unredacted workload identity token impersonation associated with ACL policies. [GH-24683]
• security: Added more host environment variables to the default deny list for tasks [GH-24540]
• security: Explicitly set 'Content-Type' header to mitigate XSS vulnerability [GH-24489]
• security: add executeTemplate to default template function_denylist [GH-24541]

IMPROVEMENTS:

• actions: Nomad Actions names now accept a wider range of names [GH-24642]
• api: Sanitise hcl variables before storage on JobSubmission [GH-24423]
• client: Emit telemetry from prerun and prestart hooks for monitoring and alerting [GH-24556]
• cni: Add Nomad specific workload information to CNI_ARGS [GH-24319]
• core: add the possibility to scale system jobs between 0 and 1 [GH-24363]
• ui: Add an Edit From Version button as an option when reverting from an older job version [GH-24168]
• ui: Adds metadata tables to Task Group and Task pages [GH-24594]

BUG FIXES:

• agent: Fixed a bug where retry_join gave up after a single failure, rather than retrying until max attempts had been reached [GH-24561]
• api: Fixed a bug where alloc exec/logs/fs APIs would return errors for non-global regions [GH-24644]
• cli: Ensure the operator autopilot health command only outputs JSON when the json flag is supplied [GH-24655]
• consul: Fixed a bug where failures when syncing Consul checks could panic the Nomad agent [GH-24513]
• consul: Fixed a bug where non-root Nomad agents could not recreate a task's Consul token on task restart [GH-24410]
• csi: Fixed a bug where drivers that emit multiple topology segments would cause placements to fail [GH-24522]
• csi: Removed redundant namespace output from volume status command [GH-24432]
• discovery: Fixed a bug where IPv6 addresses would not be accepted from cloud autojoin [GH-24649]
• drivers: fix executor leak when drivers error starting tasks [GH-24495]
• executor: validate executor on reattach to avoid possibility of killing non-Nomad processes [GH-24538]
• keyring: Fixed a bug when decrypting aead with an empty RSA block on state upserts [GH-24442]
• networking: use a tmpfs location for the state of CNI IPAM plugin used by bridge mode, to fix a bug where allocations would fail to restore after host reboot [GH-24650]
• scheduler: Fix bug where forced garbage collection does not ignore GC thresholds [GH-24456]
• scheduler: take all assigned cpu cores into account instead of only those part of the largest lifecycle [GH-24304]
• ui: Fix a bug where namespaced jobs wouldn't show diffs on the versions page [GH-24466]
• ui: Fix an issue where 2 parent jobs would see the others dispatches if it were otherwise empty [GH-24668]
• ui: Fix an issue where cmd+click or ctrl+click would double-open a var [GH-24316]
• ui: Fix an issue where system jobs with garbage-collected allocations were showing as Scaled Down [GH-24620]
• ui: Fix an issue where volumes weren't navigable [GH-24542]
• vault: Fixed a bug where expired secret leases were treated as non-fatal and retried [GH-24409]
• windows: Restore process accounting logic from Nomad 1.6.x [GH-24494]

1.9.3 (November 11, 2024)

BUG FIXES:

• fix: handles consul template re-renders on client restart [GH-24399]
• fsm: Fix bug in snapshot restore that could partially wipe state [GH-24412]

1.8.7 Enterprise (November 8, 2024)

SECURITY:

• csi: Fixed a bug where a user with csi-write-volume permissions to one namespace can create volumes in another namespace (CVE-2024-10975) [GH-24396]

BUG FIXES:

• connect: add validation to ensure that connect native services specify a port [GH-24329]
• keyring: Fixed a panic on server startup when decrypting AEAD key data with empty RSA block [GH-24383]
• scheduler: fixed a bug where resource calculation did not account correctly for poststart tasks [GH-24297]

1.7.15 (November 8, 2024)

SECURITY:

• csi: Fixed a bug where a user with csi-write-volume permissions to one namespace can create volumes in another namespace (CVE-2024-10975) [GH-24396]

BUG FIXES:

• connect: add validation to ensure that connect native services specify a port [GH-24329]
• deps: Fixed a bug where restarting Nomad could cause an unrelated process with the same PID as a failed executor to be killed [GH-24265]
• scheduler: fixed a bug where resource calculation did not account correctly for poststart tasks [GH-24297]

WARNING

Nomad 1.9.2 and Nomad 1.9.2 Enterprise shipped with a critical bug in state store restoration. See https://github.com/hashicorp/nomad/issues/24411. Users should not upgrade to Nomad 1.9.2 or Nomad 1.9.2 Enterprise. A replacement release will ship shortly.

1.9.2 (November 08, 2024)

SECURITY:

• csi: Fixed a bug where a user with csi-write-volume permissions to one namespace can create volumes in another namespace (CVE-2024-10975) [GH-24396]

IMPROVEMENTS:

• api: new parameterized dispatch endpoint sends raw HTTP request body as Payload [GH-24312]
• connect: Able to accept go-sockaddr address for consul grpc address [GH-24280]
• consul: add support for service weight [GH-24186]
• drivers: Add work_dir config to exec/rawexec/java drivers for setting the working directory of processes in a task [GH-24249]
• drivers: Move executor process out of task cgroup after task starts on cgroups v1 [GH-24340]
• drivers: add posibility to restrict user and group for exec and rawexec [GH-20073]
• fingerprint gce: fingerprint preemptibility [GH-24169]
• getter: Added option to chown artifact(s) to task user [GH-24157]
• ui: Indicates prestart/poststart tasks by running/failed/pending status [GH-24133]
• ui: Show region in header when only one region exists, and set it immediately upon logging in with a token [GH-24320]
• ui: When your token expires, upon signing back in, redirect to your original route [GH-24374]

BUG FIXES:

• cli: Corrected an ordering mistake in job tag unset help text [GH-24272]
• connect: add validation to ensure that connect native services specify a port [GH-24329]
• deps: Fixed a bug where restarting Nomad could cause an unrelated process with the same PID as a failed executor to be killed [GH-24265]
• keyring: Fixed a panic on server startup when decrypting AEAD key data with empty RSA block [GH-24383]
• scheduler: fixed a bug where resource calculation did not account correctly for poststart tasks [GH-24297]
• state: Fixed setting GC threshold to more than 72hrs being ignored [GH-24112]

IMPROVEMENTS:

• cli: Added synopsis for operator root and operator gossip command [GH-23671]

BUG FIXES:

• consul: Fixed a bug where broken Consul ACL tokens could block registration and deregistration of services and checks [GH-24166]
• consul: Fixed a bug where service deregistration could fail because Consul ACL tokens were revoked during allocation GC [GH-24166]
• deps: Fixed a bug where restarting Nomad could cause an unrelated process with the same PID as a failed executor to be killed [GH-24265]
• scheduler: fixes reconnecting allocations not getting picked correctly when replacements failed [GH-24165]
• windows: Fixed a bug where a crashed executor would orphan task processes [GH-24214]

IMPROVEMENTS:

• cli: Added synopsis for operator root and operator gossip command [GH-23671]

BUG FIXES:

• consul: Fixed a bug where broken Consul ACL tokens could block registration and deregistration of services and checks [GH-24166]
• consul: Fixed a bug where service deregistration could fail because Consul ACL tokens were revoked during allocation GC [GH-24166]
• plugins: Fix panic on systems that don't support NUMA [GH-23399]
• scheduler: fixes reconnecting allocations not getting picked correctly when replacements failed [GH-24165]
• windows: Fixed a bug where a crashed executor would orphan task processes [GH-24214]

1.9.1 (October 21, 2024)

IMPROVEMENTS:

• cli: Added synopsis for operator root and operator gossip command [GH-23671]
• cli: Updated example job specifications in nomad job init [GH-24232]

BUG FIXES:

• consul: Fixed a bug where broken Consul ACL tokens could block registration and deregistration of services and checks [GH-24166]
• consul: Fixed a bug where service deregistration could fail because Consul ACL tokens were revoked during allocation GC [GH-24166]
• docker: Always negotiate API version when initializing clients [GH-24237]
• docker: Fix incorrect auth parsing for private registries [GH-24215]
• docker: Fixed a bug where alloc exec could leak a goroutine [GH-24244]
• docker: Fixed a bug where alloc exec with stdin would hang [GH-24202]
• docker: Fixed a bug where task CPU stats were reported incorrectly [GH-24229]
• heartbeat: Fixed a bug where failed nodes would not be marked down [GH-24241]
• scheduler: fixes reconnecting allocations not getting picked correctly when replacements failed [GH-24165]
• ui: Fix an issue where a dropdown on the variables page would appear underneath table headers [GH-24162]
• ui: Put a max-width on token name so it doesn't collide with the search box in the top nav [GH-24240]
• windows: Fixed a bug where a crashed executor would orphan task processes [GH-24214]

SECURITY:

• security: Fixed a bug in client FS API where the check to prevent reads from the secrets dir could be bypassed on case-insensitive file systems [GH-24125]

BUG FIXES:

• bug: Allow client template config block to be parsed when using json config [GH-24007]
• cli: Fixed a bug in job status command where -t would act as though -json was also set [GH-24054]
• licensing: Fixed a bug where environment variable to opt-out of reporting was not respected
• scaling: Fixed a bug where scaling policies would not get created during job submission unless namespace field was set in jobspec [GH-24065]
• state: Fixed a bug where compatibility updates for node topology for nodes older than 1.7.0 were not being correctly applied [GH-24127]
• template: Fixed a panic on client restart when using change_mode=script [GH-24057]

SECURITY:

• security: Fixed a bug in client FS API where the check to prevent reads from the secrets dir could be bypassed on case-insensitive file systems [GH-24125]

IMPROVEMENTS:

• cli: Increase default log level and duration when capturing logs with operator debug [GH-23850]

BUG FIXES:

• bug: Allow client template config block to be parsed when using json config [GH-24007]
• cli: Fixed a bug in job status command where -t would act as though -json was also set [GH-24054]
• licensing: Fixed a bug where environment variable to opt-out of reporting was not respected
• scaling: Fixed a bug where scaling policies would not get created during job submission unless namespace field was set in jobspec [GH-24065]
• state: Fixed a bug where compatibility updates for node topology for nodes older than 1.7.0 were not being correctly applied [GH-24127]
• task: adds node.pool attribute to interpretable values in task env [GH-24052]
• template: Fixed a panic on client restart when using change_mode=script [GH-24057]

1.9.0 (October 10, 2024)

BREAKING CHANGES:

• heartbeats: clients older than 1.6.0 will fail heartbeats to 1.9.0+ servers [GH-23838]
• jobspec: Removed support for HCLv1 [GH-23912]
• services: Clients older than 1.5.0 will fail to read Nomad native services via template blocks [GH-23910]
• tls: Removed deprecated tls.prefer_server_cipher_suites field from agent configuration [GH-23712]

SECURITY:

• security: Fixed a bug in client FS API where the check to prevent reads from the secrets dir could be bypassed on case-insensitive file systems [GH-24125]

IMPROVEMENTS:

• cli: Added redaction options to operator snapshot commands [GH-24023]
• cli: Increase default log level and duration when capturing logs with operator debug [GH-23850]
• deps: Upgraded yamux to v0.1.2 to fix a bug where RPC connections could deadlock [GH-24058]
• docker: Use official docker SDK instead of a 3rd party client [GH-23966]
• identity: Added filepath parameter to identity block for persisting workload identities [GH-24038]
• jobs: Added Version Tags to job versions, to prevent them from being garbage collected and allow for diffs [GH-24055]
• keyring: Stored wrapped data encryption keys in Raft [GH-23977]
• metrics: introduce client config to include alloc metadata as part of the base labels [GH-23964]
• networking: Added an option to ignore static port collisions when scheduling, for programs that use the SO_REUSEPORT unix socket option [GH-23956]
• networking: IPv6 can now be enabled on the Nomad bridge network mode [GH-23882]
• quotas (Enterprise): Added the possibility to set device count limits [GH-23894]
• raft: Bump raft to v1.7.1 which includes pre-vote. This should make servers more stable after network partitions [GH-24029]

BUG FIXES:

• bug: Allow client template config block to be parsed when using json config [GH-24007]
• cli: Fixed a bug in job status command where -t would act as though -json was also set [GH-24054]
• scaling: Fixed a bug where scaling policies would not get created during job submission unless namespace field was set in jobspec [GH-24065]
• state: Fixed a bug where compatibility updates for node topology for nodes older than 1.7.0 were not being correctly applied [GH-24127]
• task: adds node.pool attribute to interpretable values in task env [GH-24052]
• template: Fixed a panic on client restart when using change_mode=script [GH-24057]
• ui: Fixes an issue where variables paths would not let namespaced users write variables unless they also had wildcard namespace variable write permissions [GH-24073]

SECURITY:

• security: Fixed a bug in client FS API where the check to prevent reads from the secrets dir could be bypassed on case-insensitive file systems [GH-24125]

IMPROVEMENTS:

• metrics: introduce client config to include alloc metadata as part of the base labels [GH-23964]

BUG FIXES:

• bug: Allow client template config block to be parsed when using json config [GH-24007]
• scaling: Fixed a bug where scaling policies would not get created during job submission unless namespace field was set in jobspec [GH-24065]
• state: Fixed a bug where compatibility updates for node topology for nodes older than 1.7.0 were not being correctly applied [GH-24127]
• ui: Fixes an issue where variables paths would not let namespaced users write variables unless they also had wildcard namespace variable write permissions [GH-24073]

BREAKING CHANGES:

• heartbeats: clients older than 1.6.0 will fail heartbeats to 1.9.0+ servers [GH-23838]
• jobspec: Removed support for HCLv1 [GH-23912]
• services: Clients older than 1.5.0 will fail to read Nomad native services via template blocks [GH-23910]
• tls: Removed deprecated tls.prefer_server_cipher_suites field from agent configuration [GH-23712]

IMPROVEMENTS:

• cli: Added redaction options to operator snapshot commands [GH-24023]
• cli: Increase default log level and duration when capturing logs with operator debug [GH-23850]
• deps: Upgraded yamux to v0.1.2 to fix a bug where RPC connections could deadlock [GH-24058]
• docker: Use official docker SDK instead of a 3rd party client [GH-23966]
• identity: Added filepath parameter to identity block for persisting workload identities [GH-24038]
• jobs: Added Version Tags to job versions, to prevent them from being garbage collected and allow for diffs (GH-24055)
• keyring: Stored wrapped data encryption keys in Raft [GH-23977]
• networking: Added an option to ignore static port collisions when scheduling, for programs that use the SO_REUSEPORT unix socket option [GH-23956]
• networking: IPv6 can now be enabled on the Nomad bridge network mode [GH-23882]
• quotas (Enterprise): Added the possibility to set device count limits [GH-23894]
• raft: Bump raft to v1.7.1 which includes pre-vote. This should make servers more stable after network partitions [GH-24029]

BUG FIXES:

• cli: Fixed a bug in job status command where -t would act as though -json was also set [GH-24054]
• task: adds node.pool attribute to interpretable values in task env [GH-24052]
• template: Fixed a panic on client restart when using change_mode=script [GH-24057]